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NETWORK MONITORING 
APPARATUS, COMPUTER- 
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NETWORK MONITORING 
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MONITORING METHOD 

Cross Reference to Related Applications 

This patent application claims priority from a Japanese patent application, No. 2001- 
250707 filed on August 21 , 2001 , the contents of which are incorporated herein by 
reference. 

Background of Invention 
Field of the Invention 

[0001] The present invention relates to a network monitoring apparatus, a computer- 
readable medium storing a network monitoring program, and a network monitoring 
method thereof. More particularly, the present invention relates to a network 
monitoring apparatus that provides notification of an operation of a communication 
device in a computer network by selecting a predetermined notification from a 
plurality of stored notifications based upon a detected operation of the 
communication device. 

Description of the Related Art 

[0002] 

Japanese Patent Application Laid-Open No. 11-31114 discloses a remote network 
management system that monitors the status of a communication device 
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communicating in a computer network by displaying an image of the communication 
device using GUI (graphical user interface). Further, Japanese Patent Application Laid- 
Open No. 11-161 587 discloses a network connection equipment management 
application that lights up an image of an LED of an interconnecting device to be 
managed using GUI, which is similar to an LED of a connection port equipped by the 
interconnecting device such as a switching hub, router, or the like, to indicate whether 
or not communication is possible. 

[0003] However, if only an image of an equipment to be monitored is displayed, it is 

difficult for an administrator of the computer network to rapidly and accurately obtain 
information of what kind of fault has occurred in the equipment being monitored. 
Moreover, communication traffic for a network monitoring apparatus to communicate 
with the equipment to be monitored is increased by always monitoring a plurality of 
communication devices that communicate in the computer network, thereby causing a 
problem of an excessive communication load being applied to the whole computer 
network. 

Summary of Invention 

[0004] Therefore, it is an object of the present invention to provide a network monitoring 
apparatus, a computer-readable medium storing a network monitoring program, and 
a method thereof, which are capable of overcoming the above drawbacks 
accompanying the conventional art. The above and other objects can be achieved by 
combinations described in the independent claims. The dependent claims define 
further advantageous and exemplary combinations of the present invention. 

[0005] According to the first aspect of the present invention, a network monitoring 

apparatus for monitoring an interconnecting device that interconnects communication 
in a computer network, comprises: a first storage unit having a plurality of 
notifications stored therein corresponding to each of a plurality of operations in the 
interconnecting device, respectively; a detection unit that detects each of the 
operations in the interconnecting device; and a notification unit that selects one of the 
notifications stored in the first storage unit based on the detected operation to notify 
of the detected operation of the interconnecting device by the selected notification. 
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[0006] The detection unit may detect the each of the plurality of operations in the 
interconnecting device at a different interval. 

[0007] An interval for detecting whether or not the interconnecting device is operating 
may be shorter than an interval for detecting communication traffic in the 
interconnecting device. 

[0008] The detection unit may transmit a detection signal to the interconnecting device 
and may detect the operations of the interconnecting device based on a response 
signal to the detection signal from the interconnecting device. 

[0009] The network monitoring apparatus may further comprise a second storage unit for 
storing an information signal indicating an operation of the interconnecting device, 
the information signal being received from the interconnecting device and stored 
corresponding to a time when the information signal is received, in which the 
detection unit detects the operations of the interconnecting device by referring to the 
information signal stored in the second storage unit. 

4 [001 0] The detection unit may detect the each of the operations of a plurality of the 
interconnecting devices at a different interval. 

£ [001 1] the interconnecting device may have a plurality of connection ports to which a 

plurality of communication devices are respectively connected, and the detection unit 
may detect a communication status of each of the plurality of connection ports in the 
interconnecting device at a different interval. 

[001 2] The notification unit may transmit an e-mail to a predetermined e-mail address as 
the selected one of the notifications to notify of the detected operation of the 
interconnecting device. 

[0013] 

According to the second aspect of the present invention, a network monitoring 
apparatus for monitoring a plurality of communication devices that communicate in a 
computer network, comprises: a detection unit that detects an operation of a 
predetermined communication device of the plurality of communication devices; a 
scheduling unit that schedules a monitoring interval, which is an interval for 
monitoring the predetermined communication device, based on the operation 
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detected by the detection unit; and a monitoring unit for monitoring the 
predetermined communication device based on the monitoring interval set by the 
scheduling unit. 

[001 4] The detection unit may detect a type of the predetermined communication device 
as the operation of the predetermined communication device and the scheduling unit 
may schedule the monitoring interval for the predetermined communication device 
based on the type of the predetermined communication device detected by the 
detection unit. 

[001 5] The scheduling unit may schedule the monitoring interval for a server computer 
type of the predetermined communication device to be shorter than the monitoring 
interval for a client computer type of the predetermined communication device. 

Q [001 6] The detection unit may detect communication traffic of the predetermined 
I! communication device as the operation of the predetermined communication device 

y and the scheduling unit may schedule the monitoring interval for the predetermined 

j communication device based on the communication traffic detected by the detection 

^ unit. 

± [001 7] The predetermined communication device may have a plurality of connection 
Z ports to which a plurality of communication devices are respectively connected, and 

j the scheduling unit may schedule a monitoring interval, which is a corresponding 

interval for monitoring a communication status of each of the plurality of connection 
ports of the predetermined communication device, respectively. 

[001 8] The detection unit may detect a corresponding communication device type 

connected to each of the plurality of connection ports, respectively, as the operation 
of the predetermined communication device, and the scheduling unit may respectively 
schedule the monitoring interval of each of the plurality of connection ports based on 
the corresponding communication device type detected by the detection unit. 

[001 9] The scheduling unit may schedule the monitoring interval for a first connection 
port to which a server computer is connected to be shorter than the monitoring 
interval for a second connection port to which a client computer is connected. 
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[0020] The detection unit may detect respective communication traffic for each of the 
plurality of connection ports and the scheduling unit may respectively schedule the 
monitoring interval for each of the plurality of connection ports based on the 
communication traffic detected by the detection unit. 

[0021] According to the third aspect of the present invention, a computer-readable 
medium storing a network monitoring program for a computer to monitor an 
interconnecting device that interconnects communication in a computer network, the 
program comprises: a storage module operable to make the computer store a plurality 
of notifications to notify of each of a plurality of operations in the interconnecting 
device, respectively; a detection module operable to make the computer detect each 
of the operations in the interconnecting device; and a notification module operable to 
make the computer select one of the notifications stored in the computer based on 

£ the detected operation and to notify of the detected operation in the interconnecting 

P device by the selected notification. 

Z [0022] The detection module may be operable to make the computer detect the each of 
4 the plurality of operations in the interconnecting device at a different interval. 

± [0023] The detection module may make the computer detect each of the plurality of 
^ operations in a plurality of the interconnecting devices at a different interval. 

[0024] According to the fourth aspect of the present invention, a computer-readable 
^ medium storing a network monitoring program for a computer that monitors a 

plurality of communication devices communicating in a computer network, the 
program comprises: a detection module operable to make the computer detect an 
operation of a predetermined communication device of the plurality of communication 
devices; a scheduling module operable to make the computer schedule a monitoring 
interval, which is an interval for monitoring the predetermined communication device, 
based on the operation detected by the computer; and a monitoring module operable 
to make the computer monitor the predetermined communication device based on the 
monitoring interval scheduled by the scheduling module. 



[0025] 



The detection module may be operable to make the computer detect a type of the 
predetermined communication device as the operation of the predetermined 
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communication device; and the scheduling module may be operable to make the 
computer schedule the monitoring interval for the predetermined communication 
device based on the type of the predetermined communication device detected by the 
computer. 

[0026] The detection module may be operable to make the computer detect 

communication traffic of the predetermined communication device; and the 
scheduling module may be operable to make the computer schedule the monitoring 
interval of the predetermined communication device based on the communication 
traffic detected by the computer. 

According to the fifth aspect of the present invention, a network monitoring 
method of monitoring an interconnecting device that interconnects communication in 
a computer network, the method comprises: storing a plurality of notifications to 
notify of each of a plurality of operations in the interconnecting device, respectively; 
detecting an operation in the interconnecting device; and selecting one of the stored 
notifications based on the detected operation and notifying of the detected operation 
of the interconnecting device by the selected notification. 

According to the sixth aspect of the present invention, a network monitoring 
method of monitoring a plurality of communication devices that communicate in a 
computer network, the method comprises: detecting an operation of a predetermined 
communication device of the plurality of communication devices; scheduling a 
monitoring interval, which is an interval at which the predetermined communication 
device is monitored, based on the detected operation; and monitoring the 
predetermined communication device based on the monitoring interval. 

[0029] This summary of the present invention does not necessarily describe all necessary 
features so that the invention may also be a sub-combination of these described 
features. 

Brief Description of Drawings 

[0030] Fig. 1 is a schematic representation of a computer network 1 00 according to the 
present invention. 
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[0031] Fig. 2 depicts schematically components of a network monitoring apparatus 10 
according to the present invention. 

[0032] Fig. 3 shows a data format of a notification file stored in a first storage unit 1 04 of 
the network monitoring apparatus 1 0 according to the present invention. 

[0033] Fig. 4 shows a data format of a trap information file stored in a second storage 
unit 1 1 0 of the network monitoring apparatus 1 0 according to the present invention. 

[0034] Fig. 5 shows a data format of a monitoring interval file stored in a third storage 
unit 112 of the network monitoring apparatus 10 according to the present invention. 

[0035] Fig. 6 is a flowchart of one example of a network monitoring method according to 
the present invention. 

! [0036] Fig. 7 is a flowchart of a monitoring condition changing process (SI 04) of the 
network monitoring method in Fig. 6. 

: [0037] Fig. 8 is one example of a monitoring table displayed by a display unit 1 05 of the 
network monitoring apparatus 10 according to the present invention. 

[0038] Fig. 9 is a flowchart of an interval monitoring process (SI 1 4) of the network 
monitoring method in Fig. 6. 

; [0039] Fig. 1 0 is a schematic diagram showing hardware components in the network 
monitoring apparatus 10 according to the present invention. 

Detailed Description 

[0040] The invention will now be described based on preferred embodiments, which do 
not intend to limit the scope of the present invention, but rather to exemplify the 
invention. All of the features and the combinations thereof described in the 
embodiments are not necessarily essential to the invention. 

[0041] 

Fig. 1 shows a computer network 100 according to one embodiment of the 
present invention having a network monitoring apparatus 10 to monitor 
communication devices in the computer network 100; interconnecting devices 20a, 
20b, and 20c to interconnect communication in the computer network 100; client 
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computers, for example, PCs, 30a, 30b, and 30c to communicate in computer network 
1 00; and server computers having server functions such as DHCP server 40, DNS 
server 42 and Web server 44. Interconnecting devices 20a, 20b, and 20c, client 
computers 30a, 30b, and 30c, DHCP server 40, DNS server 42 and Web server 44 are 
some examples of communication devices. 

[0042] Network monitoring apparatus 10 detects the operations of the communication 
devices that communicate in computer network 100 and informs an administrator of 
computer network 100 of the detected operations of the communication devices. A 
notification file, i.e., a file stored in the network monitoring apparatus 1 0 (as 
described hereinafter) having a plurality of notifications therein, may be set by the 
administrator, or may be set at the time of shipment of the network monitoring 
apparatus 10 from the manufacture. 

\ [0043] Network monitoring apparatus 10 stores the notification file and the notifications 
therein corresponding to the various operations of the communication devices in the 
computer network 100. Network monitoring apparatus 10 informs, i.e., notifies, of a 
detected operation by using a predetermined notification in the stored notification file 
that corresponds to the detected operation of the communication device that is being 
monitored. For example, the notifications in the notification file may be a display of 
one or more image indicating an operation or operations of the communication 
devices, a pop-up display, an e-mail transmission, generation of tones/sounds such 
as a buzzer, etc. Thus, the administrator can be rapidly and accurately informed of the 
operations of the communication devices in the computer network 100 by setting the 
notifications in the notification file based upon the respective operations of the 
detected communication devices. The administrator can, therefore, immediately cope 
with a failure when such failures occur in the communication devices in the computer 
network 1 00. 

[0044] 

Network monitoring apparatus 1 0 monitors each of a plurality of communication 
devices in the computer network 100 at a different interval depending on the 
operation or a communication device type of the communication devices in the 
computer network 100. For example, network monitoring apparatus 10 monitors 
interconnecting devices 20a, 20b, and 20c, or communication devices, which serve an 
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important role in computer network 1 00, such as DHCP server 40, DNS server 42 and 
Web server 44, at a short interval of time; and monitors client computers 30a, 30b, 
and 30c, or the like, at a comparatively long interval of time. 

[0045] Further, network monitoring apparatus 10 in the present embodiment monitors 
the communication devices in the computer network 1 00 depending on a 
communication device type connected to connection ports of each of a plurality of 
interconnecting devices 20a, 20b, and 20c at each of different intervals of time. For 
example, network monitoring apparatus 10 monitors connection ports to which 
interconnecting devices 20a, 20b, and 20c, or communication devices like DHCP 
server 40, DNS server 42, and Web server 44, which serve an important role in 
computer network 100, are connected at a short interval. On the other hand, network 
monitoring apparatus 10 monitors the connection ports to which client computers 
30a, 30b, and 30c are connected at a comparatively long interval. 

y [0046] Network monitoring apparatus 10 of the present embodiment, monitors the 
communication devices or the connection ports in the computer network 100 at 
suitable or desirable intervals. Network monitoring apparatus 10 monitors each of the 
plurality of communication devices in the computer network 100 at a different interval 
depending on the operation or the communication device type of the respective 
communication devices in the computer network 100. Network monitoring apparatus 
10 monitors each of the plurality of connection ports of interconnecting devices 20a 
to 20c at a different interval depending on the communication device type of the 
respective communication devices connected to each of the plurality of connection 
ports of interconnecting devices 20a to 20c in the computer network 100. Therefore, 
it is possible to set a longer monitoring interval for a communication device or a 
connection port that does not need to be frequently monitored, and thereby reduce 
the communication traffic of the network monitoring apparatus 1 0 with the 
communication devices to be monitored in the computer network 100. Accordingly, 
the communication load due to communication monitoring traffic in computer 
network 100 can be reduced. 

[0047] 

Fig. 2 shows the network monitoring apparatus 10 having a detection unit 114 to 
detect operations of the communication devices communicating in computer network 



APP ID=09683078 



Page 9 



1 00; transmit unit 1 1 8 to transmit a detection signal to detect the operations of the 
communication devices with detection unit 114; receive unit 102 to receive a response 
signal corresponding to the detection signal from the communication devices; 
scheduling unit 106 to schedule a monitoring interval, which is an interval to monitor 
a communication device in the computer network 100 based on the operations of the 
communication device detected by detection unit 1 1 4; input unit 1 08 to input 
information that is inputted by the administrator to scheduling unit 1 06; display unit 
105 to display a monitoring status scheduling screen or a monitored result in the 
communication devices in the computer network 1 00; and notification unit 1 1 6 to 
notify of the operations of the communication devices in the computer network 100 
by using a predetermined notification in a stored notification file (described 
hereinafter) based on the operations of the communication devices in the computer 
network 100 detected by detection unit 114. Detection unit 1 14 is one example of the 
monitoring unit and monitors the communication devices in the computer network 
100 by detecting the operations of the communication devices. 

[0048] Network monitoring apparatus 1 0 is provided with a first storage unit 104 to store 
a notification file having a plurality of notifications to notify of respective operations 
corresponding to the operations of the communication devices in the computer 
network 1 00; second storage unit 1 10 to store one or more information signal, 
received from the communication devices, indicating the operations of the 
communication devices in the computer network 1 00; and third storage unit 1 1 2 to 
store one or more monitoring interval of the connection ports of interconnecting 
devices 20a, 20b, and 20c, or one or more monitoring interval of the communication 
devices in the computer network 1 00. The monitoring intervals are stored to 
correspond with the associated connection ports of interconnecting device 20a, 20b, 
or 20c, or the associated communication devices in the computer network 1 00. 

[0049] Transmit unit 1 1 8 transmits one or more detection signal to detect the operations 
of the communication devices in the computer network 100 to be monitored based on 
requests of detection unit 1 14. Receive unit 102 receives a response signal from the 
communication devices in the computer network 100 in response to the detection 
signal. Detection unit 1 14 detects the operations of the communication devices in the 
computer network 100 based on the response signal received from the 
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communication devices by receive unit 102. 

[0050] For example, the transmit unit 1 1 8 transmits an ICMP echo request message by a 
ping command as a detection signal to the communication device to be monitored. 
When receive unit 1 02 receives the ICMP echo response message from the 
communication device being monitored, detection unit 1 14 detects that the 
communication device being monitored operates normally on computer network 100. 
When receive unit 102 does not receive the ICMP echo response message from the 
communication device being monitored, detection unit 1 14 detects that the 
communication device being monitored does not operate normally on computer 
network 100. 

[0051] Receive unit 102 receives one or more information signal indicating the operations 
of the communication devices in the computer network 100 from the communication 
devices. Second storage unit 1 1 0 stores the information signal or signals received 
from the communication devices being monitored so as to correspond to the time 
when receive unit 102 received the one or more information signal. Detection unit 1 14 
detects the operations of the communication devices being monitored by referring to 
the one or more information signal stored in second storage unit 110. 

[0052] For example, receive unit 102 receives a link Up trap, a link Down trap, a cold 
Start trap, or the like, as examples of one or more information signal indicating the 
operations of the communication devices in the computer network 100. Second 
storage unit 1 1 0 stores the trap information that receive unit 1 02 receives from the 
communication devices being monitored so as to correspond to the time when receive 
unit 102 receives the trap information. Detection unit 1 14 detects the operations of 
the communication devices based on the trap information stored in second storage 
unit 110. 

[0053] Detection unit 114 may request interconnecting devices 20a, 20b, and 20c to 
send information indicating communication traffic of each of the plurality of 
associated connection ports and detect the received communication traffic 
information as the operations of the interconnecting devices 20a, 20b, and 20c. 
Further, detection unit 1 14 may detect communication traffic of client computers 30a, 
30b, and 30c, DHCP server 40, DNS server 42 or Web server 44, which may be 



APP ID-09683078 



Page 11 of 41 



connected to each of the plurality of connection ports of the interconnecting devices 
20a, 20b, and 20c, by detecting communication traffic of each of the associated 
plurality of connection ports of interconnecting devices 20a, 20b, and 20c. 

[0054] Detection unit 1 1 4 may detect each of a plurality of operations in a 

communication device in the computer network 1 00 at a different interval. For 
example, detection unit 1 14 detects whether or not the communication devices in the 
computer network 1 00 are operating at a shorter interval than an interval at which the 
communication traffic of the communication devices in the computer network 100 is 
detected. Detection unit 1 14 may detect each of the plurality of communication 
devices in the computer network 100 at a corresponding different interval. Detection 
unit 1 1 4 detects an operation of DHCP server 40, DNS server 42 or Web server 44 at a 
shorter interval than an interval at which an operation of client computer 30a 30b or 
30c is detected. 

[0055] Detection unit 1 14 may detect a communication status of each of the plurality of 
connection ports of interconnecting device 20a, 20b, or 20c in the computer network 
100. Detection unit 1 14 detects the communication status of the respective 
connection ports to which DHCP server 40, DNS server 42, and Web server 44 may be 
connected at a shorter interval than the interval at which the communication status of 
the respective connection ports to which client computer 30a, 30b, and 30c may be 
connected is detected. 

[0056] 

Notification unit 1 1 6 selects a predetermined notification from a notification file 
stored in first storage unit 104 based on the communication device operation 
detected by detection unit 114 and informs of an operation of the communication 
device in the computer network 1 00 with the selected notification. Notification unit 
1 1 6 may notify the administrator of the operation of the communication device in the 
computer network 100 by displaying a predetermined image, i.e., a notification, 
indicating the communication device operation on display unit 105. Notification unit 
1 16 may notify the administrator of an operation of the communication device by 
transmitting an e-mail to a predetermined mail address. Notification unit 1 16 may 
notify the administrator of an operation of a communication device by generating 
predetermined tones/sounds based upon the detected communication device 
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operation. 

[0057] Scheduling unit 1 06 may schedule a monitoring interval, which is an interval to 
monitor a communication device in the computer network 1 00, based on the 
operation of the communication device detected by detection unit 114. Third storage 
unit 1 1 2 stores a monitoring interval scheduled by scheduling unit 1 06 so as to 
correspond to the associated communication device in the computer network 100. 
Detection unit 114 monitors the communication device in the computer network 100 
based on the monitoring interval stored in third storage unit 1 1 2. 

[0058] Detection unit 1 1 4 may detect the communication device type as the 

communication device operation. Scheduling unit 106 schedules the monitoring 
interval of the communication device in the computer network 100 based on the 
detected communication device type. More specifically, detection unit 114 detects 
whether or not a server function operates in the communication device being 
monitored in the computer network 100 and detects whether the communication 
device being monitored in the computer network 100 is a client computer or a server 
computer. Scheduling unit 116 schedules an interval so that a monitoring interval of a 
server computer is shorter than a monitoring interval of a client computer. Detection 
unit 1 1 4 may detect a type of a server operation in the communication device being 
monitored in the computer network 1 00. Scheduling unit 1 06 may schedule the 
monitoring interval based on the server type detected by the detection unit 1 14. 

[0059] 

Detection unit 114 may detect communication traffic of the communication device 
in the computer network 100 as the communication device operation. Scheduling unit 
106 schedules the monitoring interval of the communication device being monitored 
in the computer network 100 based on the detected communication traffic. More 
particularly, detection unit 1 14 detects communication traffic of the communication 
device in the computer network 100 connected to each of the plurality of ports of 
interconnecting devices 20a, 20b, or 20c by detecting communication traffic of each 
of the associated plurality of connection ports of interconnecting device 20a, 20b, or 
20c. Scheduling unit 106 schedules an interval so that the monitoring interval of a 
communication device being monitored in the computer network 100 with greater 
communication traffic is shorter than the monitoring interval of a communication 
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device with lesser communication traffic. 

[0060] Detection unit 1 14 may detect the communication device type of communication 
devices in the computer network 1 00 that are connected to each of the plurality of 
connection ports of interconnecting devices 20a, 20b, and 20c as associated 
communication device operation. Scheduling unit 106 schedules respective 
monitoring intervals of the plurality of connection ports of interconnecting device 20a, 
20b, or 20c based on the detected communication device type. More particularly, 
detection unit 1 14 detects whether or not the server function operates in a 
communication device that is connected to one of the plurality of connection ports of 
interconnecting device 20a, 20b, or 20c in the computer network 100 and detects 
whether the communication device being monitored is a client computer or a server 
computer. Scheduling unit 106 schedules the associated monitoring interval so that 
3 the monitoring interval of a connection port to which a server computer is connected 

S is shorter than a monitoring interval of a connection port to which a client computer is 

U connected. 

1 [0061] Detection unit 1 14 may detect communication traffic of each of the plurality of 

M connection ports of interconnecting device 20a, 20b, or 20c in the computer network 

^ 1 00 as the operation of the associated communication device. Scheduling unit 1 06 

* schedules each monitoring interval of the plurality of connection ports of 

f] interconnecting device 20a, 20b, or 20c based on the detected communication traffic. 

2 For example, scheduling unit 1 06 may schedule an interval so that the monitoring 
interval of a connection port with greater communication traffic is shorter than the 
monitoring interval of a connection port with lesser communication traffic, or, 
alternatively, so that the monitoring interval of a connection port with greater 
communication traffic is longer than the monitoring interval of a connection port with 
lesser communication traffic. 

[0062] 

According to network monitoring apparatus 10 of the present embodiment, the 
administrator is informed of the detected communication device operation in the 
computer network 100 by using a predetermined notification in a notification file that 
corresponds to the detected operation. Consequently, the administrator can rapidly 
and accurately grasp the operation of a communication device in the computer 
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network 1 00 and can cope in a timely manner with a failure when such a failure occurs 
in a communication device in the computer network 100. 

[0063] Further, according to network monitoring apparatus 10 in the present 

embodiment, it is possible to monitor a communication device in the computer 
network 100 at a different interval depending on the type or the operation of the 
communication device or the connection port of the interconnecting device 20a, 20b, 
or 20c to which the communication device may be connected. The monitoring interval 
of a communication device or a connection port to be monitored frequently in the 
computer network 1 00 can be short and the monitoring interval of a communication 
device or a connection port not to be monitored frequently can be long. Accordingly, 
communication traffic of network monitoring apparatus 10 with the communication 
device to be monitored in the computer network 1 00 can be reduced. 

[0064] Fig. 3 shows a notification file stored in first storage unit 104 having an event 
name field, a generation condition field, and an action field. The event name field 
stores an event name to identify the communication device operation of a 
communication device in the computer network 100. The generation condition field 
stores generation conditions of an operation in a communication device, which is 
identified by the corresponding event name, so as to correspond to the associated 
event name. The action field stores a notification, which is an action by the network 
monitoring apparatus 1 0 that corresponds to an event name and is executed when an 
operation of a communication device in the computer network 1 00 that is identified 
from the associated event name is performed. The notification file stores the event 
name, generation condition and action based on information input from input unit 
108 by the administrator. 

[0065] 

When receive unit 1 02 does not receive an ICMP echo response message in 
response to an ICMP echo request message by a ping command, which is transmitted 
to a communication device to be monitored in the computer network 1 00 from 
transmit unit 118, detection unit 1 14 detects that the communication device that is 
being monitored does not operate normally on the computer network 1 00 and judges 
that the event name of the communication device is "Down". Notification unit 1 16 
refers to the notification file stored in first storage unit 1 04 and informs the 
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administrator of the communication device operation by action "mail transmission", 
which is stored so as to correspond to the event name "Down". 

[0066] An action "custom" combines a display of a selected image indicating the 

associated event name of an operation by a communication device in the computer 
network 100 with, for example, transmission of an e-mail notification and a 
notification customized by the administrator. 

[0067] An action "WAV" is a notification by sound. The event name "Delete" is a deleted 
communication device operation. For example, when an ICMP echo response message 
is not received in response to a predetermined number of transmissions of an ICMP 
echo request message by the ping command, the detection unit 1 1 4 judges that the 
event name of the communication device operation in the computer network 100 is 
"Delete". 

I [0068] According to network monitoring apparatus 1 0 in the present embodiment, since 
network monitoring apparatus 10 informs the administrator of a communication 
device operation in the computer network 100 by using a predetermined notification 
from the stored notification file, which is set, for example, by the administrator so as 
to correspond to the detected communication device operation, the administrator can 
easily recognize the detected communication device operation and, when a failure in 
the communication device occurs, the administrator can immediately cope with the 
failure in the computer network 100. 

[0069] Fig. 4 is a data format of a trap information file stored in second storage unit 1 10. 
The trap information file has a receiving time field, a trap type field, and an equipment 
identifying information field. The receiving time field stores a time when network 
monitoring apparatus 10 receives a trap information from a communication device in 
the computer network 100. The trap type field stores the trap type received from the 
communication device by network monitoring apparatus 10. The equipment 
identifying information field stores the equipment identifying information of a 
communication device in the computer network 100 which transmitted the trap 
information. 

[0070] 

In the present embodiment, "I" represents equipment identifying information of 
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interconnecting device 20a, "2" represents equipment identifying information of 
interconnecting device 20b, "3" represents equipment identifying information of 
interconnecting device 20c, "4" represents equipment identifying information of client 
computer 30a, "5" represents equipment identifying information of client computer 
30b, "6" represents equipment identifying information of client computer 30c, "7" 
represents the equipment identifying information of DHCP server 40, "8" represents 
the equipment identifying information of DNS server 42, "9" represents the equipment 
identifying information of Web server 44. 

[0071] The trap information file in Fig. 4 shows that interconnecting device 20a operates 
at 32 seconds after 1 0:03 and an interface is down at 5 seconds after 1 0:1 5. When 
detection unit 1 14 detects the operation of interconnecting device 20a at 10:30, 
detection unit 1 14 refers to the trap information file stored in storage unit 1 10 and 
Q detects that the interface of interconnecting device 20a is down. 

^ [0072] According to network monitoring apparatus 1 0 in the present embodiment, since 
W the second storage unit 1 1 0 stores, in the trap information file, a history of the trap 

%j information that is received from the communication devices in the computer network 

w 1 00 by network monitoring apparatus 1 0, detection unit 1 1 4 can accurately detect the 

m operations of the communication devices in the computer network 1 00 by referring to 

12 the tra P information file in which second storage unit 1 1 0 stores the trap history. 

Q [0073] Fig. 5 is a data format of a monitoring interval file stored in third storage unit 
r ~ 1 1 2. The monitoring interval file has an equipment identifying information field, a 

port number field, and a monitoring interval field. The equipment identifying 
information field stores equipment identifying information of the communication 
devices in the computer network 100. The connection port number field stores a 
connection port number to identify a connection port of the interconnecting devices 
20a, 20b, and 20c. The monitoring interval field stores a monitoring interval of each 
communication device or connection port in the computer network 1 00 so as to 
correspond to the associated communication device or connection port. 

[0074] According to the monitoring interval file shown in Fig. 5, detection unit 114 
monitors interconnecting devices 20a, 20b, and 20c at 30 seconds monitoring 
intervals. Detection unit 1 14 monitors client computers 30a, 30b, and 30c at 2 hours 
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monitoring intervals. Detection unit 1 14 monitors DHCP server 40, DNS server 42 and 
Web server 44 at 1 minute monitoring intervals. Detection unit 114 monitors 
connection ports 1 and 2 of interconnecting device 20a, and connection port 1 of 
interconnecting device 20b at an hour monitoring interval. Detection unit 1 14 
monitors connection port 2 of interconnecting device 20b, and connection ports 1 and 
2 of interconnecting device 20c at three minutes monitoring interval. 

[0075] Since network monitoring apparatus 1 0 can monitor the communication devices in 
the computer network 1 00 at respective different intervals according to the 
communication device type or the connection port of the device, communication 
traffic of network monitoring apparatus 10 with a communication device to be 
monitored in the computer network 100 can be reduced by making the monitoring 
interval of a communication device or connection port to be monitored frequently 
short and making the monitoring interval of a communication device or connection 
port not to be monitored frequently long. 

[0076] Fig. 6 is a flowchart of one example of a network monitoring method according to 
the present embodiment. Display unit 1 05 displays a symbol, which is an image 
indicating an operation of a communication device to be monitored in the computer 
network 1 00 (SI 00). The administrator may request change of a monitoring condition 
(described hereinafter) by selecting the displayed symbol. Scheduling unit 106 judges 
whether or not the administrator has requested change of the monitoring condition 
using input unit 108 (SI 02). When change of the monitoring condition is requested in 
SI 02, the scheduling unit 1 06 changes the monitoring condition as requested by the 
administrator (SI 04). When change of the monitoring condition is not requested in 
SI 02, the monitoring condition is not changed and the routine proceeds to SI 06. 

[0077] Scheduling unit 106 refers to monitoring start conditions (described hereinafter) 
and judges whether or not a monitoring start condition is met (SI 06). When a 
monitoring start condition is not met in SI 06, the routine returns to SI 02. When a 
monitoring start condition is met in SI 06, monitoring of a communication device in 
the computer network 100 is started (SI 08). 

[0078] Detection unit 104 refers to a monitoring interval of the monitoring condition 

(SI 1 0). Detection unit 1 1 4 judges whether or not the associated monitoring interval is 
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consistent with the present monitoring start time, or the time passed since a previous 
monitoring time (SI 1 2). When the monitoring interval is consistent with time in SI 1 2, 
detection unit 1 14 monitors the communication device in the computer network 100 
(SI 1 4). When the monitoring interval is not consistent with time in SI 1 2, the 
communication device is not monitored and the routine proceeds to SI 1 6. 

[0079] Scheduling unit 1 06 refers to a finish condition of the monitoring (described 

hereinafter) and judges whether or not a monitoring finish condition is met (SI 1 6). 
When the monitoring finish condition is not met in SI 16, the routine returns to SI 02. 
When the monitoring finish condition is met in SI 1 6, monitoring of the 
communication device in the computer network 100 is finished. 

[0080] Fig. 7 is a flowchart of a monitoring condition changing process (SI 04). Display 
unit 105 displays a monitoring table that is created based on information stored in 
first storage unit 1 04 and third storage unit 1 1 2 (SI 1 8). The administrator inputs 
setting information of a monitoring condition from input unit 108 while referring to 
the monitoring table displayed on display unit 105. Scheduling unit 106 changes the 
previously set monitoring condition based on the new setting information input from 
input unit 1 08 (SI 20). The administrator may change the set monitoring condition. 
Display unit 105 updates the symbol displayed in SI 00, which is an image indicating 
the operation of a communication device to be monitored in the computer network 
100, to display the updated symbol (SI 22). Display unit 105 updates the symbol 
based on the information of the changed monitoring condition. 

[0081 ] Fig. 8 is one example of a monitoring table displayed by display unit 1 05. Display 
unit 1 05 displays the monitoring table as shown in Fig. 8, using GUI, in SI 1 8. The 
administrator determines the monitoring interval of a communication device to be 
monitored in the computer network 100 by selecting a monitoring interval tab 200. 
The administrator determines a monitoring start condition and monitoring finish 
condition by selecting a date and time specification button 202, a continuous 
monitoring button for all the time 203, or an event button 204. When the 
administrator selects the event button 204, the administrator further inputs a 
monitoring start event and a monitoring finish event. The administrator may manually 
finish monitoring by pushing a monitoring finish button 206. 
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[0082] The administrator sets evaluation order 208, event name 210, generation 

condition 212, symbol 214, log action 216, and action 218 as monitoring content 
222. Evaluation order 208 shows an order in which operations are to be evaluated in 
the communication devices in the computer network 100. Event name 210 shows an 
operation of a communication device in the computer network 100. Generation 
condition 212 shows a generating condition of the operation of the communication 
device which is identified by the associated event name. Symbol 2 1 4 shows a display 
image that is displayed by display unit 105 when the corresponding operation of the 
communication device, identified by the associated event name, is performed. The 
administrator selects or creates a desired symbol by pushing a symbol changing 
button 220. 

[0083] Log action 216 shows a selected method of processing a log of the detected 

operation of a communication device in the computer network 1 00. For example, the 
processing method includes displaying the log, storing the log, or doing nothing. 
Action 218 shows a selected notification from the stored notification file, which is to 
be used to notify the administrator of an operation of the communication device when 
the associated operation of the communication device, identified by the 
corresponding event name, is performed. 

[0084] Fig. 9 is a flowchart of an interval monitoring process (SI 14). Detection unit 1 14 
refers to the monitoring table (SI 24). Detection unit 1 14 reads one line of the 
monitoring content 222 in the evaluation order (SI 26), and interprets the generation 
condition of the operation of the communication device which is identified by the 
associated event name (SI 28). Detection unit 1 14 judges whether or not collection of 
data from the communication device to be monitored in the computer network 100 is 
required (SI 30). When detection unit 1 14 judges collection of data is necessary in 
SI 30, detection unit 1 1 4 makes transmit unit 1 1 8 transmit a detection signal to the 
communication device being monitored (SI 32). When the detection unit 1 14 judges 
collection of data is not necessary in SI 30, detection unit 1 14 searches the trap 
information stored in second storage unit 1 1 0 (SI 34). 

[0085] 

Detection unit 1 1 4 judges whether or not the generation condition read in SI 26 is 
met based on a response signal to the detection signal transmitted by transmit unit 
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11 8, or the trap information stored in second storage unit 1 1 0 (SI 34). When 
generation condition is met in SI 34, notification unit 1 1 6 informs of the detected 
operation of the communication device being monitored based on the associated 
symbol, the log action and the selected action of the monitoring content 222 read in 
SI 26 (SI 38). When the generation condition is not met in SI 34, detection unit 1 1 4 
judges whether or not the line read in SI 26 is the last line of monitoring content 222 
(SI 36). When detection unit 1 1 4 judges that the line read in SI 26 is not the last line, 
detection unit 1 1 4 returns to SI 26. Further, when detection unit 1 1 4 judges that the 
line read in SI 26 is the last line, the interval monitoring processing is finished. 

[0086] According to a network monitoring method of the present embodiment, the 
administrator can easily perform monitoring of communication devices in the 
computer network 1 00 and further can be provided with an environment that allows 
easy administration for the administrator of the computer network 1 00. The 
administrator rapidly and accurately can recognize operations of communication 
devices in the computer network 1 00 by appropriate setting of the notification file to 
relate to the respective operations of the communication devices. 

[0087] Fig. 10 is a diagram showing hardware components in network monitoring 

apparatus 10. Network monitoring apparatus 10 includes CPU 700, ROM 702, RAM 
704, communication interface 706, hard disk drive 708, data base interface 710, 
floppy disk drive 712 and CD-ROM drive 714. CPU 700 operates based on a program 
stored in ROM 702 and RAM 704. Communication interface 706 communicates with 
interconnecting device 20a, 20b, or 20c, client computer 30a, 30b, or 30c, DHCP 
server 40, DNS server 42 or Web server 44 via a computer network. Data base 
interface 71 0 writes data into a data base and updates contents of the data base. Hard 
disk drive 708 stores setting information and a program so that CPU 700 operates. 

[0088] 

Floppy disk drive 71 2 reads data or the program from floppy disk 720 and 
transmits the data or the program to CPU 700. CD-ROM drive 714 reads out data or a 
program from CD-ROM 722 and transmits the data or the program to CPU 700. 
Communication interface 706 connects to interconnecting device 20a, 20b, or 20c, 
client computer 30a, 30b, or 30c, DHCP server 40, DNS server 42, or Web server 44 to 
transmit/receive data. Data base interface 710 connects to various types of data bases 
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724 to transmit/receive data. 

[0089] The program executed by CPU 700 is stored into a recording medium such as 
floppy disk 720 or CD-ROM 722 and provided to a user. The program stored in the 
recording medium may be compressed or decompressed. The program is installed 
from the recording medium into hard disk drive 708 and the program is read into 
RAM 704 to be executed by CPU 700. 

[0090] The program stored into the recording medium and provided to the user, that is, 
the program installed into hard disk drive 708 has a receive module, a storage 
module, a display module, a scheduling module, an input module, a detection 
module, an notification module and a transmit module as a functional constitution. 
Explanation is omitted here since each module accesses a computer and processing 
performed by CPU 700 is identified as a function and an operation of corresponding 
members in network monitoring apparatus 10 which are described in connection with 
Figs. 1 to 9. 

[0091 ] Functions of one or all of operations of network monitoring apparatus 1 0 in all 
embodiments described in the present invention can be stored in floppy disk 720 or 
CD-ROM 722 as one example of the recording medium shown in Fig. 10. 

[0092] These programs may directly be read from the recording medium into the RAM to 
be executed or may be read to the RAM to be executed after the programs is installed 
into the hard disk. Further, the programs may be stored into a single recording 
medium or a plurality of recording media. Furthermore, the program may be stored in 
an encoded style. 

[0093] 

It is possible to use an optical recording medium of a DVD or a MD, an optical 
magnetic recording medium of a PD, a tape medium, a magnetic recording medium, a 
semiconductor memory such as an IC card or a miniature card, besides the floppy disk 
or the CD-ROM as the recording medium. The hard disk or the storage device of the 
RAM in a server system connected to a dedicated communication network or an 
internet may be used as the recording medium and a program may be provided to 
network monitoring apparatus 10 via a communication network. If the recording 
medium is used to manufacture/store network monitoring apparatus 10, it is obvious 
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that to manufacture and sell as a business such a recording medium would be an 
infringement of a patent right based on the present application. 

[0094] According to the present invention as aforementioned, it is possible to provide a 
network monitoring apparatus that notifies of an operation of a communication device 
to be monitored in a computer network by using a predetermined notification 
corresponding to a detected operation of the communication device being monitored. 

[0095] Although the present invention has been described by way of exemplary 

embodiments, it should be understood that many changes and substitutions may be 
made by those skilled in the art without departing from the spirit and the scope of the 
present invention which is defined only by the appended claims. 
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